JPWO2014041829A1 - Safety arithmetic device, safety input device, safety output device and safety controller - Google Patents

Abstract

The memory includes a processor (11) and a memory (12). The memory includes a first memory area (12A) and a second memory area (12B) having an address different from the first memory area. A first processing step including a program process of input data written in the memory area, a program process of input data written in the second memory area, and the provision of a redundant code to the output data written in the second memory area An execution control unit (13) that executes a second processing step including: output data that has been given a redundant code in the first processing step, and output data that has been given a redundant code in the second processing step. Result collation unit (14) for collation, operation diagnosis unit (15) for diagnosing the presence or absence of a failure of the processor and memory, verification in the redundancy check, result collation unit, and operation diagnosis If an abnormality is detected in at least one of diagnosis in section, it has the abnormality processing unit stopping output of the output data (16), the.

Description

  The present invention relates to a safety arithmetic device, a safety input device, a safety output device, and a safety controller, and more particularly, to a configuration of a safety controller that performs an internal diagnosis for ensuring a highly reliable control operation.

  Safety controllers for safety control, for example, according to IEC61508, an international standard for functional safety, both hardware failures that are permanent failures of circuits in processors and memories and software failures that are temporary failures Is required to be detectable.

  For internal diagnosis of the safety controller, for example, there are known a method of comparing the operation results of two processors and performing a mutual diagnosis, and a method of executing the same operation processing twice in one processor and comparing the processing results. Yes. For example, Patent Document 1 discloses a method of writing the results of executing the same arithmetic processing twice by one processor in different memories.

JP 59-194204 A

  According to the configuration described in Patent Document 1, outputs from two memories are unified using a duplexed demultiplexer and flip-flop circuit. The collation of the result of executing the arithmetic processing twice by the processor is realized by a duplicated hardware circuit. When this dual circuit configuration is adopted, there is a problem that the safety controller is complicated and expensive because a redundant circuit configuration is required compared to a general configuration including a single input / output circuit. .

  The present invention has been made in view of the above, and realizes a simple and low-cost single circuit configuration, and can detect both a hardware failure and a software failure, a safety input device, a safety An object is to obtain an output device and a safety controller.

  In order to solve the above-described problems and achieve the object, the present invention provides a processor that performs program processing of input data, the input data that is input to the processor, and output data that is a result of the program processing. And the memory can hold the input data and the output data in each of a first memory area and a second memory area having an address different from the first memory area. The processor performs the program processing of the input data written in the first memory area, and assigns a redundant code to the output data written in the first memory area as a result of the program processing. , The program processing of the input data written in the second memory area, and the program An execution control unit for executing a second processing step including adding a redundant code to the output data written in the second memory area as a result of the processing; and the redundant code in the first processing step A result collating unit that collates the output data that has been given and the output data that has been given the redundant code in the second processing step, and an arithmetic diagnostic unit that diagnoses whether the processor and the memory are faulty by calculation And an abnormality process for stopping output of the output data when an abnormality is detected in at least one of the redundancy check of the input data and the output data, the verification in the result verification unit, and the diagnosis in the arithmetic diagnosis unit And a portion.

  The safety arithmetic device according to the present invention has a single circuit configuration including a processor and a memory. The execution control unit executes program processing on the input data read from the first memory area and the input data read from the second memory area, respectively. The result verification unit detects a software failure by verifying the results of the program processing for both input data. The arithmetic diagnosis unit detects a hardware failure in the processor and the memory. As a result, the safety arithmetic device is simple and low-cost as a single circuit configuration, and has the effect of being able to detect both hardware and software failures.

FIG. 1 is a block diagram illustrating a configuration of a safety controller including a safety arithmetic device according to the first embodiment of the present invention. FIG. 2 is a flowchart showing the operation procedure of the safety controller (part 1). FIG. 3 is a flowchart showing the operation procedure of the safety controller (part 2). FIG. 4: is a flowchart which shows the operation | movement procedure of a safety controller provided with the safety calculating apparatus concerning Embodiment 2 of this invention (the 1). FIG. 5: is a flowchart which shows the operation | movement procedure of a safety controller provided with the safety calculating apparatus concerning Embodiment 2 of this invention (the 2). FIG. 6 is a block diagram illustrating a configuration of a safety controller including the safety arithmetic device according to the sixth embodiment of the present invention. FIG. 7: is a block diagram which shows the structure of the safety controller provided with the safety input device concerning Embodiment 7 of this invention. FIG. 8 is a flowchart showing an operation procedure of the safety input device. FIG. 9 is a block diagram illustrating a configuration of a safety controller including the safety output device according to the eighth embodiment of the present invention. FIG. 10 is a flowchart showing an operation procedure of the safety output device. FIG. 11 is a block diagram showing the configuration of the safety controller according to the ninth embodiment of the present invention. FIG. 12 is a block diagram showing a configuration of the safety controller according to the tenth embodiment of the present invention.

  Hereinafter, embodiments of a safety arithmetic device, a safety input device, a safety output device, and a safety controller according to the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
FIG. 1 is a block diagram illustrating a configuration of a safety controller including a safety arithmetic device according to the first embodiment of the present invention. The safety controller includes a safety calculation device 10, a safety input device 18, and a safety output device 19.

  The safety arithmetic device 10 performs arithmetic processing for safety control. The safety input device 18 receives an input signal input to the safety controller. The safety output device 19 outputs an output signal from the safety controller to the outside. The safety arithmetic device 10, the safety input device 18 and the safety output device 19 are internally connected to each other via a bus 20.

  The safety calculation device 10 includes a processor 11 and a memory 12. The processor 11 performs program processing of input data input to the safety arithmetic device 10. The memory 12 holds input data input to the processor 11 and output data that is a result of the program processing.

  The memory 12 has a first memory area 12A and a second memory area 12B that are independent of each other. The second memory area 12B has a different address from the first memory area 12A. Each of the first memory area 12A and the second memory area 12B can hold input data and output data.

  The processor 11 includes an execution control unit 13, a result matching unit 14, an operation diagnosis unit 15, an abnormality processing unit 16, and an input / output processing unit 17. The execution control unit 13 executes a first process for input data written to the first memory area 12A and a second process for input data written to the second memory area 12B. The result collating unit 14 collates the output data written in the first memory area 12A in the first process and the output data written in the second memory area 12B in the second process.

  The operation diagnosis unit 15 diagnoses the presence or absence of a failure in the processor 11 and the memory 12 by operation. For the diagnosis of the processor 11 and the memory 12 by the arithmetic diagnosis unit 15, for example, a test pattern is used. The abnormality processing unit 16 stops the output of the output data when an abnormality is detected in at least one of the redundancy check of the input data and the output data, the verification in the result verification unit 14, and the diagnosis in the arithmetic diagnosis unit 15.

  The input / output processing unit 17 transfers input data between the safety input device 18 and the first memory area 12A and the second memory area 12B, and the safety output device 19 and the first memory area 12A and the second memory area 12B. The output data between.

  2 and 3 are flowcharts showing the operation procedure of the safety controller. The safety input device 18 gives a redundant code to the input data. The input / output processing unit 17 reads input data to which a redundant code is assigned from the safety input device 18. The input / output processing unit 17 writes the read input data into the first memory area 12A and the second memory area 12B (step S1).

  The execution control unit 13 checks a redundant code accompanying the input data (first input data) written in the first memory area 12A (step S2). The redundant code is, for example, CRC (Cyclic Redundancy Checking).

  When an abnormality is detected in the redundancy check (step S3, Yes), the abnormality processing unit 16 stops the operation of the safety controller (step S18). On the other hand, if it is confirmed by the redundancy check in step S2 that there is no abnormality (step S3, No), the execution control unit 13 executes a program process for the first input data (step S4). The program is, for example, an application program created by the user. The execution control unit 13 uses the first input data and the self-saved data held in the first memory area 12A in the program processing.

  The execution control unit 13 writes the output data (first output data), which is the processing result in step S4, in the first memory area 12A (step S5). The execution control unit 13 rewrites the self-stored data held in the first memory area 12A according to the processing result in step S4.

  The execution control unit 13 assigns a redundant code to the first output data written to the first memory area 12A (step S6). The redundant code is, for example, CRC. Steps S2 to S6 correspond to a first process for the first input data written in the first memory area 12A.

  Next, the execution control unit 13 checks the redundant code accompanying the input data (second input data) written in the second memory area 12B (step S7). The redundant code is, for example, CRC. When an abnormality is detected in the redundancy check (step S8, Yes), the abnormality processing unit 16 stops the operation of the safety controller (step S18). On the other hand, if it is confirmed by the redundancy check in step S7 that there is no abnormality (step S8, No), the execution control unit 13 executes a program process for the second input data (step S9).

  The first memory area 12A and the second memory area 12B have the same memory map except that the offset addresses are different. The execution control unit 13 executes the same program with respect to the second input data as an offset address different from that in the process of the first input data in step S4. The execution control unit 13 uses the second input data and the self-saved data held in the second memory area 12B in the program processing.

  The execution control unit 13 writes the output data (second output data), which is the processing result in step S9, in the second memory area 12B (step S10). The execution control unit 13 rewrites the self-stored data held in the second memory area 12B according to the processing result in step S9.

  The execution control unit 13 gives a redundant code to the second output data written to the second memory area 12B (step S11). The redundant code is, for example, CRC. Steps S7 to S11 correspond to a second process for the second input data written to the second memory area 12B.

  Next, the result matching unit 14 compares and collates the first output data that has been given the redundant code in step S6 and the second output data that has been given the redundant code in step S11 (step S12). In addition to the first and second output data, the result collating unit 14 may include self-stored data whose value may be changed in the range of the comparison collation.

  When abnormality is detected in the collation by the result collation unit 14 (step S13, Yes), the abnormality processing unit 16 stops the operation of the safety controller (step S18). On the other hand, when it is confirmed that there is no abnormality in the collation in the result collation unit 14 (No in step S13), the input / output processing unit 17 reads the first output data from the first memory area 12A and makes the first output data safe. Write to the output device 19.

  The safety output device 19 checks the redundant code accompanying the first output data written by the input / output processing unit 17 (step S14). If an abnormality is detected in the redundancy check (step S15, Yes), the abnormality processing unit 16 stops the output of the first output data by the safety output device 19 (step S18). On the other hand, when it is confirmed by the redundancy check in step S14 that there is no abnormality (No in step S15), the safety output device 19 outputs the first output data.

  Next, the operation diagnosis unit 15 diagnoses whether the processor 11 and the memory 12 are faulty (step S16). The arithmetic diagnosis unit 15 diagnoses an arithmetic unit (ALU) of the processor 11 using a test pattern. As the test pattern, one that can confirm that each bit of the register of the ALU can be turned ON / OFF independently is selected.

  For example, in the case of an ALU that performs summation, confirmation of each bit (0, 0), (0, 1), (1, 0), (1, 1) of two registers to be operated and Carry out the carry operation. Furthermore, in order to confirm that there is no short between adjacent memory bits, test patterns (0x5555 and 0xAAAA) that result in different adjacent bits are selected.

  The arithmetic diagnosis unit 15 writes and reads different test patterns to the designated addresses in the first memory area 12A and the second memory area 12B. The first memory area 12A and the second memory area 12B have different offset addresses and the same memory map. In the same test pattern, even if there is a failure in which the offset address line is fixed, the same value is written to the same address in the first memory area 12A and the second memory area 12B, making accurate failure diagnosis difficult. The arithmetic diagnosis unit 15 writes different values in advance to the designated addresses in the first memory area 12A and the second memory area 12B, and compares the read value with the value at the time of writing, thereby failing the address line. Diagnose.

  If an abnormality is detected in the failure diagnosis of the processor 11 and the memory 12 (step S17, Yes), that is, if at least one of the processor 11 and the memory 12 has a failure, the abnormality processing unit 16 performs the operation of the safety controller. Stop (step S18). The abnormality processing unit 16 turns off the signal output from the first memory area 12A and the second memory area 12B.

  On the other hand, when it is confirmed by the failure diagnosis of the processor 11 and the memory 12 that there is no abnormality, that is, there is no failure in either the processor 11 or the memory 12 (No in step S17), the safety controller returns to step S1, Continue operation for safety control.

  When an abnormality is detected in at least one of the redundant check of the input data and the output data, the verification in the result verification unit 14, and the diagnosis in the arithmetic diagnosis unit 15, the safety controller stops the operation indefinitely by stopping the operation in step S18. It becomes a loop state. As a result, the safety controller stops outputting the output data when an abnormality is detected.

  The safety controller can detect the occurrence of the failure from the collation result by the result collating unit 14 when a software fault occurs in either the processor 11 or the memory 12 of the safety arithmetic device 10. The safety controller may continue the operation after performing a predetermined measure in addition to stopping the operation when there is a software failure.

  Even if a software failure is detected in a certain cycle in software processing, it may be resolved after the next cycle. For example, the safety controller may apply the output data in the cycle immediately before the cycle in which the failure is detected to the cycle to continue the processing in the next cycle and not treat it as an error. The safety controller may stop the operation when it detects failures continuously in a predetermined number of cycles.

  When a hardware failure occurs in either the processor 11 or the memory 12, the safety controller can detect the occurrence of the failure from the diagnosis result by the arithmetic diagnosis unit 15. If a hardware failure is detected in a certain cycle of software processing, it will not be resolved after the next cycle. For this reason, when the safety controller detects a hardware failure, the safety controller immediately stops its operation.

  The safety controller employs a single circuit configuration including the processor 11, the memory 12, the safety input device 18, and the safety output device 19. The safety controller can detect both hardware and software failures without adopting a duplexed hardware structure. The safety controller can realize a simple and low cost as a single circuit configuration.

Embodiment 2. FIG.
FIG. 4 and FIG. 5 are flowcharts showing an operation procedure of the safety controller including the safety arithmetic device according to the second embodiment of the present invention. The safety controller according to the present embodiment has the same configuration as the safety controller according to the first embodiment (see FIG. 1). Of the operation procedures in the present embodiment, steps S1 to S9 are the same as steps S1 to S9 (see FIG. 2) of the operation procedures in the first embodiment.

  The execution control unit 13 bit-inverts the output data (second output data) that is the processing result in step S9 (step S20). The execution control unit 13 writes the second output data that has undergone bit inversion into the second memory area 12B (step S10). In addition, the execution control unit 13 rewrites the self-stored data held in the second memory area 12B according to the processing result in step S9 and bit-inverts the data.

  The execution control unit 13 gives a redundant code to the second output data written to the second memory area 12B (step S11). The redundant code is, for example, CRC. Steps S7 to S11 correspond to a second process for the second input data written to the second memory area 12B.

  Next, the result matching unit 14 compares and collates the first output data that has been given the redundant code in step S6 and the second output data that has been given the redundant code in step S11 (step S12). In step S12, the result collating unit 14 collates the first output data and the second output data by a method of obtaining mutual exclusive OR. Thereafter, the operation procedure from step S13 to step S15 is the same as the operation procedure from step S13 to step S15 in the first embodiment.

  When it is confirmed by the redundancy check in step S14 that there is no abnormality (step S15, No), the safety output device 19 outputs the first output data. Next, the operation diagnosis unit 15 diagnoses the presence or absence of a failure of the processor 11 (step S21). The second output data held in the second memory area 12B undergoes bit inversion in step S20 with respect to the first output data held in the first memory area 12A. The failure of the address line can be detected by comparing and collating the first output data and the second output data. Therefore, in the second embodiment, failure diagnosis of the memory 12 by the arithmetic diagnosis unit 15 is not necessary.

  The operation procedure of step S17 and step S18 is the same as the operation procedure of step S17 and step S18 in the first embodiment. As in the first embodiment, the safety controller according to the second embodiment realizes simple and low cost as a single circuit configuration, and can detect both hardware failure and software failure.

Embodiment 3 FIG.
The safety controller according to the third embodiment has the same configuration as the safety controller according to the first embodiment (see FIG. 1). In the operation procedure of the safety controller according to the present embodiment, in step S20 of the operation procedure of the safety controller according to the second embodiment (see FIGS. 4 and 5), conversion to a complement is performed instead of bit inversion. . Here, the operation procedure of the present embodiment will be described with reference to the flowcharts of FIGS.

  The execution control unit 13 converts the output data (second output data), which is the processing result in step S9, into a complement. The execution control unit 13 writes the second output data that has been converted to the complement into the second memory area 12B (step S10). Further, the execution control unit 13 rewrites the self-stored data held in the second memory area 12B according to the processing result in step S9 and converts it into a complement.

  The result matching unit 14 compares and collates the first output data that has been given the redundant code in step S6 and the second output data that has been given the redundant code in step S11 (step S12). In step S12, the result collating unit 14 collates the first output data and the second output data depending on whether or not the sum is zero. The subsequent operation procedure is the same as the operation procedure from step S13 to step S18 in the second embodiment.

  In the third embodiment, as in the second embodiment, the first output data written in the first memory area 12A and the second output data written in the second memory area 12B have different values. The failure of the address line can be detected by comparing and collating the first output data and the second output data. Therefore, in the third embodiment, failure diagnosis of the memory 12 by the arithmetic diagnosis unit 15 is not necessary.

  As in the first and second embodiments, the safety controller according to the third embodiment realizes simple and low cost as a single circuit configuration, and can detect both hardware failures and software failures.

Embodiment 4 FIG.
The safety controller according to the fourth embodiment has the same configuration as the safety controller according to the first embodiment (see FIG. 1). In the operation procedure of the safety controller according to the present embodiment, in the operation procedure of the safety controller according to the second embodiment (see FIG. 4 and FIG. 5), in step S20, conversion to reverse endian is performed instead of bit inversion. Do. Here, the operation procedure of the present embodiment will be described with reference to the flowcharts of FIGS.

  For example, the execution control unit 13 converts the output data (second output data), which is the processing result in step S9, by reversing the upper and lower bits of 16-bit data. The execution control unit 13 writes the second output data that has undergone endian inversion into the second memory area 12B (step S10). The execution control unit 13 rewrites the self-stored data held in the second memory area 12B according to the processing result in step S9 and reverses the endian.

  The result matching unit 14 compares and collates the first output data that has been given the redundant code in step S6 and the second output data that has been given the redundant code in step S11 (step S12). At this time, the result matching unit 14 reads the second output data held in the second memory area 12B with the endian reversed. The result collating unit 14 collates the first output data with the second output data that has undergone endian inversion. The subsequent operation procedure is the same as the operation procedure from step S13 to step S18 in the second embodiment.

  In the fourth embodiment, as in the second and third embodiments, the first output data written to the first memory area 12A and the second output data written to the second memory area 12B have different values. The failure of the address line can be detected by comparing and collating the first output data and the second output data. Therefore, in the fourth embodiment, failure diagnosis of the memory 12 by the arithmetic diagnosis unit 15 is not necessary.

  As in the first to third embodiments, the safety controller according to the fourth embodiment realizes simple and low cost as a single circuit configuration, and can detect both hardware failures and software failures.

  The safety controller according to the fourth embodiment may reverse the endian for the output data (first output data) that is the processing result in step S4. The result collation unit 14 reads out the first output data held in the first memory area 12A and the second output data held in the second memory area 12B with the endian reversed in comparison and comparison. Also good.

Embodiment 5 FIG.
The safety controller according to the fifth embodiment has the same configuration as the safety controller according to the first embodiment (see FIG. 1). The operation procedure of the safety controller according to the present embodiment is the same as the operation procedure of the safety controller according to the first embodiment (see FIGS. 2 and 3). Here, the operation procedure of the present embodiment will be described with reference to the flowcharts of FIGS.

  In the program processing of the first input data (step S4), the execution control unit 13 uses a program generated as a 16-bit compiler. On the other hand, in the program processing of the second input data (step S9), the execution control unit 13 uses a program generated as a 32-bit compiler.

  Most of the data handled by the controller is 16-bit data. In step S4, the execution control unit 13 loads the 16-bit first input data into the register and executes the 16-bit instruction. The execution control unit 13 writes 16-bit first output data, which is the processing result, in the first memory area 12A (step S5).

  In step S9, the processor 11 loads the 16-bit second input data into the register and executes the 32-bit instruction. The execution control unit 13 writes the 16-bit second output data as the processing result in the second memory area 12B (step S10).

  In the fifth embodiment, instructions executed on the first input data and the second input data are different from each other. The result collation unit 14 can detect a software failure and a hardware failure of the processor 11 by comparing and collating the first output data and the second output data. Therefore, in the fifth embodiment, failure diagnosis of the processor 11 by the arithmetic diagnosis unit 15 is not necessary.

  As in the first to fourth embodiments, the safety controller according to the fifth embodiment can achieve both simple and low cost as a single circuit configuration, and can detect both hardware failures and software failures.

Embodiment 6 FIG.
FIG. 6 is a block diagram illustrating a configuration of a safety controller including the safety arithmetic device according to the sixth embodiment of the present invention. The safety controller includes a safety calculation device 30, a safety input device 18, and a safety output device 19. The same parts as those in the first embodiment are denoted by the same reference numerals, and repeated description will be omitted as appropriate.

  The safety arithmetic device 30 performs arithmetic processing for safety control. The safety calculation device 30, the safety input device 18, and the safety output device 19 are internally connected to each other via a bus 20. The safety input device 18 calculates a redundant code based on the input data to the safety controller. The safety input device 18 generates an input message in which a redundant code and incidental information are added to the input data. The input message includes input data and a redundant code. The redundant code is, for example, CRC. The incidental information is header information, for example.

  The safety arithmetic unit 30 includes a processor 31 and a memory 12. The processor 31 performs a program process for the input data input to the safety calculation device 30. The memory 12 holds an input message that is input to the processor 31 and an output message that is a result of the program processing.

  The processor 31 includes an execution control unit 32, a result matching unit 33, a control calculation unit 34, a message processing unit 35, a calculation diagnosis unit 36, an abnormality processing unit 37, and a transmission / reception unit 38. The transmission / reception unit 38 receives an input message from the safety input device 18 and transmits an output message to the safety output device 19. The transmission / reception unit 38 transfers the input message between the safety input device 18 and the first memory region 12A and the second memory region 12B, and between the safety output device 19 and the first memory region 12A and the second memory region 12B. The output message is transferred.

  The message processing unit 35 performs input message processing and output message processing. The message processing unit 35 decodes and inspects the redundant code assigned to the input message as input message processing. As an output message process, the message processing unit 35 adds a redundant code to the output data and generates an output message.

  The control calculation unit 34 performs control calculation on the input data included in the input message from the message processing unit 35. The control calculation unit 34 executes, for example, safety control logic. The execution control unit 32 executes a first process for the input message written in the first memory area 12A and a second process for the input message written in the second memory area 12B.

  The result collating unit 33 collates the output message written in the first memory area 12A in the first process and the output message written in the second memory area 12B in the second process.

  The arithmetic diagnosis unit 36 diagnoses the presence or absence of a failure in the processor 31 and the memory 12 by calculation. For example, a test pattern is used for diagnosis of the processor 31 and the memory 12 by the arithmetic diagnosis unit 36.

  The abnormality processing unit 37 stops the output message output when an abnormality is detected in at least one of the redundancy check of the input data and the output data, the verification in the result verification unit 33, and the diagnosis in the arithmetic diagnosis unit 36.

  Next, the operation procedure of the safety controller will be described. The transmission / reception unit 38 reads from the safety input device 18 an input message in which a redundant code is added to the input data. The transmission / reception unit 38 writes the read input message in the first memory area 12A and the second memory area 12B.

  The message processing unit 35 performs input message processing on the input message read by the transmission / reception unit 38. In the first process, the message processing unit 35 decodes a redundant code accompanying the input message and performs a redundancy check. The message processing unit 35 checks input data and header information included in the input message. The execution control unit 32 writes the input message that has undergone the input message processing in the message processing unit 35 in the first memory area 12A.

  The execution control unit 32 sends the input message read from the first memory area 12A to the control calculation unit 34 in the first process. The control calculation unit 34 performs control calculation of input data included in the input message, for example, safety control logic. The execution control unit 32 writes the input data that has undergone the control calculation in the control calculation unit 34 as output data in the first memory area 12A.

  The execution control unit 32 sends the output data read from the first memory area 12A to the message processing unit 35 in the first processing step. The message processing unit 35 performs output message processing on the output data read from the first memory area 12A. The message processing unit 35 calculates a redundant code based on the output data, and gives the redundant code to the output data. The execution control unit 32 writes the output data to which the redundant code is assigned as an output message in the first memory area 12A. The execution control unit 32 executes input message processing, control calculation, and output message processing in the first processing step, and records the results in the first memory area 12A as needed.

  Next, in the second process, the message processing unit 35 decodes a redundant code associated with the input message and performs a redundancy check. The message processing unit 35 checks input data and header information included in the input message. The execution control unit 32 writes the input message that has undergone the input message processing in the message processing unit 35 into the second memory area 12B.

  The execution control unit 32 sends the input message read from the second memory area 12B to the control calculation unit 34 in the second processing step. The control calculation unit 34 performs control calculation of input data included in the input message, for example, safety control logic. The execution control unit 32 writes the input data that has undergone the control calculation in the control calculation unit 34 as output data in the second memory area 12B.

  The execution control unit 32 sends the output data read from the second memory area 12B to the message processing unit 35 in the second processing step. The message processing unit 35 performs output message processing on the output data read from the second memory area 12B. The message processing unit 35 calculates a redundant code based on the output data. The message processing unit 35 generates an output message in which a redundant code is added to the output data. The execution control unit 32 writes the output message generated by the message processing unit 35 in the second memory area 12B. The execution control unit 32 executes input message processing, control calculation, and output message processing in the second processing step, and records the results in the second memory area 12B as needed.

  The result collation unit 33 compares and collates the output message written in the first memory area 12A and the output message written in the second memory area 12B. The abnormality processing unit 37 stops the output message output when an abnormality is detected in at least one of the redundancy check of the input data and the output data, the verification in the result verification unit 33, and the diagnosis in the arithmetic diagnosis unit 36.

  Also in the sixth embodiment, the safety controller can realize a simple and low cost as a single circuit configuration as in the first embodiment.

Embodiment 7 FIG.
FIG. 7: is a block diagram which shows the structure of the safety controller provided with the safety input device concerning Embodiment 7 of this invention. The safety controller includes a safety input device 40, a safety calculation device 50, and a safety output device 19.

  The safety arithmetic device 50 performs arithmetic processing for safety control. The safety input device 40 receives an input signal input to the safety controller. The safety output device 19 outputs an output signal from the safety controller to the outside. The safety input device 40, the safety calculation device 50, and the safety output device 19 are internally connected to each other via the bus 20.

  The safety input device 40 includes an input unit 41, a processor 42, and a memory 43. The input unit 41 digitizes an input signal to the safety input device 40 and uses it as input data. The processor 42 performs program processing of input data from the input unit 41. The memory 43 holds input data input to the processor 42.

  The memory 43 has a first memory area 43A and a second memory area 43B that are independent of each other. The second memory area 43B has an address different from that of the first memory area 43A. Both the first memory area 43A and the second memory area 43B can hold input data.

  The processor 42 includes an input calculation unit 44, an input diagnosis unit 45, a message processing unit 46, an execution control unit 47, a result matching unit 48, and a transmission unit 49. The input calculation unit 44 performs calculation processing on the input data from the input unit 41. The input diagnosis unit 45 diagnoses whether there is an abnormality in the input unit 41 by transmitting a test signal to the input unit 41.

  The message processing unit 46 adds a redundant code and incidental information to the input data as input message processing. As a result, the message processing unit 46 generates an input message for the safety calculation device 50.

  The execution control unit 47 executes a first processing process including writing of an input message to the first memory area 43A and a second processing process including writing of an input message to the second memory area 43B.

  The result collating unit 48 collates the input message written in the first memory area 43A in the first process and the input message written in the second memory area 43B in the second process.

  The transmission unit 49 transmits either the input message written in the first memory area 43A or the input message written in the second memory area 43B to the safety arithmetic device 50.

  FIG. 8 is a flowchart showing an operation procedure of the safety input device. The input diagnosis unit 45 transmits a test signal to the input unit 41 (step S31). The input diagnosis unit 45 determines whether there is an abnormality in the input unit 41 (step S32).

  The input diagnosis unit 45 checks whether or not the input data value matches the test signal in the input unit 41. When the input signal is a digital signal, the input diagnosis unit 45 uses a signal obtained by inverting ON / OFF from the current value of the input data as a test signal. For example, when the value of the corresponding input channel is “ON”, the input diagnosis unit 45 transmits an OFF signal as a test signal. When the input calculation unit 44 confirms the OFF signal, the input diagnosis unit 45 determines that there is no abnormality in the input unit 41. When the value of the corresponding input channel is “OFF”, the input diagnosis unit 45 may transmit an ON signal as a test signal.

  When the input signal is an analog signal, the input diagnosis unit 45 uses a waveform that fluctuates within the range of the analog input range as the test signal. When the input calculation unit 44 confirms the waveform of the test signal, the input diagnosis unit 45 determines that the input unit 41 has no abnormality. The input signal unit 45 may transmit the value within the range of the analog input to the input unit 41 in a plurality of times. When the input calculation unit 44 confirms the value, the input diagnosis unit 45 determines that there is no abnormality in the input unit 41. The input diagnosis unit 45 selects a test signal so that the ON / OFF of each bit after AD conversion can be confirmed.

  When the input diagnosis unit 45 determines that there is an abnormality in the input unit 41 (step S32, Yes), the transmission unit 49 stops the transmission of the input message to the safety arithmetic device 50 (step S43). The safety controller stops operation.

  When the input diagnosis unit 45 determines that there is no abnormality in the input unit 41 (No in step S32), the input unit 41 samples and digitizes signals from a plurality of input terminals. The input unit 41 acquires digitized input data (step S33). The input calculation unit 44 performs input data filtering for each input channel of the input unit 41 (step S34). The input calculation unit 44 determines a value (input value) of input data to be passed by filtering.

  When the input signal is a digital signal, the input calculation unit 44 determines the value as an input value when the input signal having a predetermined period has the same value. Alternatively, the input calculation unit 44 determines a value having the highest frequency among the values of the input signal having a predetermined period as the input value. When the input signal is an analog signal, the input calculation unit 44 determines the moving average value of the input signal in a predetermined cycle as the input value. The input calculation unit 44 may determine the input value after removing a value that has changed suddenly in a predetermined cycle of the input signal.

  The message processing unit 46 adds a redundant code and incidental information to the input data from the input calculation unit 44. The redundant code is, for example, CRC. The incidental information is header information, for example. The message processing unit 46 generates an input message (first input message) in which redundant code and header information are added to the input data (step S35).

  The message processing unit 46 adds transmission / reception station information and a message number as header information to the communication header of the input data. The message processing unit 46 calculates a CRC code for the header information and payload (input data). The message processing unit 46 adds the calculated CRC code to the payload.

  The safety arithmetic unit 50 can detect bit corruption of the input message by recalculating the CRC code. Further, the safety arithmetic device 50 can determine whether or not the received input message is an input message to be received by checking the header information.

  The execution control unit 47 writes the first input message from the message processing unit 46 in the first memory area 43A (step S36). The first process is a process from step S33 to step S35. In addition to storing the first input message, the first memory area 43A also functions as a storage area for variables in the first process.

  Next, similarly to step S34, the input calculation unit 44 performs a filtering process on the input data for each input channel of the input unit 41 (step S37). The message processing unit 46 adds the redundant code and header information to the input data from the input calculation unit 44 as in step S35. The message processing unit 46 generates an input message (second input message) in which redundant code and header information are added to the input data (step S38).

  The execution control unit 47 writes the second input message from the message processing unit 46 in the second memory area 43B (step S39). The second process is a process from step S37 to step S39. In addition to storing the second input message, the second memory area 43B also functions as a storage area for variables and the like in the second processing step.

  The result matching unit 48 reads the first input message from the first memory area 43A. The result matching unit 48 reads the second input message from the second memory area 43B. The result collating unit 48 compares and collates the read first input message and second input message (step S40).

  When an abnormality is detected in the collation by the result collation unit 48 (step S41, Yes), the transmission unit 49 stops the transmission of the input message to the safety arithmetic device 50 (step S43). The safety controller stops operation.

  When it is confirmed that there is no abnormality in the collation by the result collation unit 48 (step S41, No), the transmission unit 49 transmits the first input message or the second input message to the safety arithmetic device 50 (step S42). For example, the transmission unit 49 reads the second input message from the second memory area 43B. The transmission unit 49 transmits the read second input message to the safety calculation device 50. When the input message is transmitted from the transmission unit 49 to the safety calculation device 50, the safety input device 40 returns to step S31 and continues the operation for accepting the input of the input signal to the safety controller.

  When a software failure occurs in either the processor 42 or the memory 43, the safety input device 40 can detect the occurrence of the failure from the collation result by the result collation unit 48. The safety input device 40 may continue the operation after performing a predetermined measure in addition to stopping the operation when there is a software failure.

  Even if a software failure is detected in a certain cycle in software processing, it may be resolved after the next cycle. For example, the safety input device 40 may apply the input message in the cycle immediately before the cycle in which the failure is detected to the cycle to continue the processing in the next cycle and not treat it as an error. The safety input device 40 may stop the operation when the failure is continuously detected at a predetermined number of cycles.

  When a hardware failure occurs in either the processor 42 or the memory 43, it is difficult for the safety input device 40 to detect the occurrence of the failure by the verification by the result verification unit 48. In order to self-diagnose a hardware failure, the safety input device 40 executes, for example, a predetermined diagnostic program in the middle of a cycle.

  The safety input device 40 performs diagnosis by the input diagnosis unit 45 on the entire range of the input signal to the input unit 41. The safety input device 40 can detect an erroneous input due to the occurrence of sticking of circuit components or the occurrence of drift in the input unit 41 having a single circuit configuration. The safety input device 40 and the safety arithmetic device 50 can detect an error in the input message by a single communication means by performing a redundancy check on the input message and checking the header information. The safety input device 40 can prevent mixing of software errors by collating the input message in the result collating unit 48.

  The safety input device 40 employs a single circuit configuration including an input unit 41, a processor 42, and a memory 43. The safety input device 40 according to the seventh embodiment realizes simple and low cost as a single circuit configuration, and can detect both hardware failure and software failure.

  The operation of the processor 42 of the safety input device 40 may be added with the same operation as that of the processor 11 (see FIG. 1) in the first to fifth embodiments.

Embodiment 8 FIG.
FIG. 9 is a block diagram illustrating a configuration of a safety controller including the safety output device according to the eighth embodiment of the present invention. The safety controller includes a safety input device 18, a safety calculation device 50, and a safety output device 60.

  The safety arithmetic device 50 performs arithmetic processing for safety control. The safety input device 18 receives an input signal input to the safety controller. The safety output device 60 outputs an output signal from the safety controller to the outside. The safety input device 18, the safety calculation device 50, and the safety output device 60 are internally connected to each other via the bus 20.

  The safety output device 60 includes an output unit 61, a processor 62, and a memory 63. The processor 62 performs program processing of the output message. The memory 63 holds output data included in the output message. The output unit 61 outputs an output signal corresponding to the output data.

  The memory 63 has a first memory area 63A and a second memory area 63B that are independent of each other. The second memory area 63B has an address different from that of the first memory area 63A. Both the first memory area 63A and the second memory area 63B can hold output data.

  The processor 62 includes a power cutoff unit 64, an output diagnosis unit 65, a result collation unit 66, an output calculation unit 67, a message processing unit 68, an execution control unit 69, and a reception unit 70. The receiving unit 70 receives an output message from the safety calculation device 50.

  As the output message processing, the message processing unit 68 inspects the content of the output message based on the redundant code and accompanying information included in the output message. The output calculation unit 67 performs calculation processing for extracting output data from the output message. The execution control unit 69 executes a first processing process including writing output data to the first memory area 63A and a second processing process including writing output data to the second memory area 63B.

  The result collating unit 66 collates the output data written in the first memory area 63A in the first process and the output data written in the second memory area 63B in the second process.

  The output diagnosis unit 65 diagnoses whether there is an abnormality in the output unit 61 by transmitting a test signal to the output unit 61. The power shutoff unit 64 shuts off the power to the output unit 61 according to the diagnosis result from the output diagnostic unit 65.

  FIG. 10 is a flowchart showing an operation procedure of the safety output device. The output diagnosis unit 65 transmits a test signal to the output unit 61 (step S51). The output diagnosis unit 65 determines whether there is an abnormality in the output unit 61 (step S52).

  The output diagnosis unit 65 checks whether the output data value matches the test signal in the output unit 61. When the output signal is a digital signal, the output diagnosis unit 65 uses a signal obtained by inverting ON / OFF from the current value of the output data as a test signal. The output diagnosis unit 65 outputs a test signal to the output unit 61.

  For example, when the value of the corresponding output terminal is “ON”, the output diagnosis unit 65 transmits an OFF signal as a test signal. When the output diagnosis unit 65 confirms the OFF signal within a certain time, the output diagnosis unit 65 determines that there is no abnormality in the output unit 61. Alternatively, the output diagnosis unit 65 reads the signal at the output terminal and compares the read signal value with the expected output data value.

  When the output signal is an analog signal, the output diagnosis unit 65 transmits the value of the range range of the DA converter to the output unit 61 in a plurality of times. The output diagnosis unit 65 reads the value of the output data of the output unit 61, and determines that the output unit 61 has no abnormality when the read value is within the error range. It is assumed that the test by the output diagnosis unit 65 is performed within a short time such that the device connected to the output terminal does not react. The output unit 61 may continuously output an output signal based on the current output data during the test by the output diagnosis unit 65.

  When the output diagnosis unit 65 determines that there is an abnormality in the output unit 61 (step S52, Yes), the power cut-off unit 64 cuts off the power supply of the output unit 61 (step S63). The safety output device 60 forcibly sets the output signal from the output unit 61 to zero by shutting off the power supply of the output unit 61.

  When the output diagnosis unit 65 determines that there is no abnormality in the output unit 61 (step S52, No), the reception unit 70 receives an output message from the safety arithmetic device 50 (step S53). The message processing unit 68 inspects the content of the output message (first output message) received by the receiving unit 70 (step S54).

  The output message includes a redundant code and accompanying information. The redundant code is, for example, CRC. The incidental information is header information, for example. The message processing unit 68 detects bit corruption of the first output message by recalculating the CRC code of the first output message. Further, the message processing unit 68 confirms the transmission / reception station information and the message number, which are header information, to determine whether or not the received first output message is a correct output message from which the safety output device 60 should obtain an output signal. Judging.

  The output calculation unit 67 extracts the output data (first output data) for each output terminal of the output unit 61 from the first output message. The output calculation unit 67 performs the filtering process on the first output data (step S55). The output calculation unit 67 determines the moving average value in a predetermined cycle or the continuous same value as the value (output value) of the first output data to be passed by the filtering process. The output calculation unit 67 prevents vibration of the output value by filtering.

  The execution control unit 69 writes the first output data from the output calculation unit 67 in the first memory area 63A (step S56). The first process is a process from step S54 to step S56. In addition to storing the first output data, the first memory area 63A also functions as a storage area for variables in the first process.

  Next, the message processing unit 68 inspects the content of the output message (second output message) received by the receiving unit 70, similarly to step S54 (step S57). The message processing unit 68 detects bit corruption in the second output message by recalculating the CRC code of the second output message. Further, the message processing unit 68 confirms the transmitting / receiving station information and the message number which are the header information, so that the received second output message is a correct output message from which the safety output device 60 should obtain the output signal. Judging.

  Similarly to step S55, the output calculation unit 67 extracts the output data (second output data) for each output terminal of the output unit 61 from the second output message. The output calculation unit 67 performs the filtering process on the second output data (step S58).

  The execution control unit 69 writes the second output data from the output calculation unit 67 in the second memory area 63B (step S59). The second process is a process from step S57 to step S59. In addition to storing the second output data, the second memory area 63B also functions as a storage area for variables and the like in the second processing step.

  The result matching unit 66 reads the second output data from the first memory area 63A. The result matching unit 66 reads the second output data from the second memory area 63B. The result collation unit 66 compares and collates the read first output data and second output data (step S60).

  When abnormality is detected in the collation by the result collation unit 66 (step S61, Yes), the power shutoff unit 64 shuts off the power supply of the output unit 61 (step S63). The safety output device 60 forcibly sets the output signal from the output unit 61 to zero by shutting off the power supply of the output unit 61.

  When it is confirmed that there is no abnormality in the collation by the result collating unit 66 (No at Step S61), the output unit 61 outputs an output signal based on the first output data or the second output data (Step S62). When the output unit 61 outputs the output signal, the safety output device 60 returns to step S51 and continues the operation for outputting the output signal.

  The safety output device 60 can detect the occurrence of a failure from the collation result by the result collation unit 66 when a software fault occurs in either the processor 62 or the memory 63. The safety output device 60 may continue the operation after performing a predetermined measure in addition to stopping the operation when there is a software failure.

  Even if a software failure is detected in a certain cycle in software processing, it may be resolved after the next cycle. For example, the safety output device 60 may continue the processing after the next cycle without treating it as an error by applying the output data in the cycle immediately before the cycle in which the failure is detected to the cycle. The safety output device 60 may stop the operation when the failure is continuously detected at a predetermined number of cycles.

  When a hardware failure occurs in either the processor 62 or the memory 63, it is difficult for the safety output device 60 to detect the occurrence of the failure by the verification by the result verification unit 66. In order to self-diagnose a hardware failure, the safety output device 60 executes a predetermined diagnostic program in the middle of a cycle, for example.

  The safety output device 60 performs diagnosis by the output diagnosis unit 65 for the entire output range of the output unit 61. The safety output device 60 can detect an erroneous output due to the occurrence of sticking of circuit components or the occurrence of drift in the output unit 61 having a single circuit configuration. The safety output device 60 and the safety arithmetic device 50 can detect an error in the output message by a single communication means by performing redundancy check of the output message and confirmation of the header information. The safety output device 60 can prevent software errors from being mixed by collating output data in the result collating unit 66.

  The safety output device 60 employs a single circuit configuration including an output unit 61, a processor 62, and a memory 63. The safety output device 60 according to the eighth embodiment realizes simple and low cost as a single circuit configuration, and can detect both hardware failure and software failure.

  The operation of the processor 62 of the safety output device 60 may be added with the same operation as that of the processor 11 (see FIG. 1) in the first to fifth embodiments.

Embodiment 9 FIG.
FIG. 11 is a block diagram showing the configuration of the safety controller according to the ninth embodiment of the present invention. The safety controller includes a safety input device 18, a safety arithmetic device 10, a safety output device 19, a gateway 80, and an engineering tool 81. The safety calculation device 10 is, for example, the safety calculation device 10 according to the first embodiment.

  The engineering tool 81 is a tool for editing a sequence program that is operated by a PLC system or the like, for example. The engineering tool 81 is realized by, for example, a personal computer in which engineering tool software is installed.

  The safety arithmetic device 10, the safety input device 18 and the safety output device 19 are internally connected to each other via a bus 20. The engineering tool 81 is connected to the bus 20 via the gateway 80. The switch and sensor 83 are connected to the input unit of the safety input device 18. The actuator and contactor 84 are connected to the output part of the safety output device 19.

  The engineering tool 81 changes or writes the safety control program and setting parameters of the safety arithmetic device 10. The safety controller can detect both a hardware failure and a software failure by adopting the safety arithmetic device 10 without adopting a redundant hardware structure. The safety controller can realize a simple and low cost as a single circuit configuration.

  The same operation as that of the safety controller according to the second to fifth embodiments may be added to the operation of the safety controller. The safety controller 30 (see FIG. 6) according to the sixth embodiment may be applied to the safety controller.

  As the safety controller, the safety input device 40 (see FIG. 7) according to the seventh embodiment may be applied. In this case, the engineering tool 81 designates input data filtering processing conditions and input diagnosis conditions for the safety input device 40. In this case as well, the safety controller can realize a simple and low cost as a single circuit configuration.

  As the safety controller, the safety output device 60 (see FIG. 9) according to the eighth embodiment may be applied. In this case, the engineering tool 81 designates conditions for output data filtering processing and conditions for output diagnosis to the safety output device 60. In this case as well, the safety controller can realize a simple and low cost as a single circuit configuration.

  The safety controller may be, for example, a combination of the safety arithmetic device 30 according to the sixth embodiment, the safety input device 40 according to the seventh embodiment, and the safety output device 60 according to the eighth embodiment.

Embodiment 10 FIG.
FIG. 12 is a block diagram showing a configuration of the safety controller according to the tenth embodiment of the present invention. The same parts as those in the ninth embodiment are denoted by the same reference numerals, and repeated description will be omitted as appropriate.

  The safety controller includes a safety input device 18, a safety arithmetic device 10, a safety output device 19, a network connection device 85, and an engineering tool 81. The safety calculation device 10 is, for example, the safety calculation device 10 according to the first embodiment. The safety arithmetic device 10, the safety input device 18, the safety output device 19, and the engineering tool 81 are connected to each other via a network connection device 85.

  The engineering tool 81 changes or writes the safety control program and setting parameters of the safety arithmetic device 10. The safety controller can detect both a hardware failure and a software failure by adopting the safety arithmetic device 10 without adopting a redundant hardware structure. The safety controller can realize a simple and low cost as a single circuit configuration.

  The same operation as that of the safety controller according to the second to fifth embodiments may be added to the operation of the safety controller. The safety controller 30 (see FIG. 6) according to the sixth embodiment may be applied to the safety controller.

  As the safety controller, the safety input device 40 (see FIG. 7) according to the seventh embodiment may be applied. In this case, the engineering tool 81 designates input data filtering processing conditions and input diagnosis conditions for the safety input device 40. In this case as well, the safety controller can realize a simple and low cost as a single circuit configuration.

  As the safety controller, the safety output device 60 (see FIG. 9) according to the eighth embodiment may be applied. In this case, the engineering tool 81 designates conditions for output data filtering processing and conditions for output diagnosis to the safety output device 60. In this case as well, the safety controller can realize a simple and low cost as a single circuit configuration.

  The safety controller may be, for example, a combination of the safety arithmetic device 30 according to the sixth embodiment, the safety input device 40 according to the seventh embodiment, and the safety output device 60 according to the eighth embodiment.

  The safety controller of the present invention is useful as a safety controller responsible for safety control of machines and facilities.

  DESCRIPTION OF SYMBOLS 11 Processor, 12 memory, 12A 1st memory area, 12B 2nd memory area, 13 Execution control part, 14 Result collation part, 15 Computation diagnostic part, 16 Abnormality processing part, 17 Input / output processing part, 18 Safety input device, 19 Safety output device, 20 bus, 30 safety arithmetic device, 31 processor, 32 execution control unit, 33 result verification unit, 34 control arithmetic unit, 35 message processing unit, 36 arithmetic diagnosis unit, 37 abnormality processing unit, 38 transmission / reception unit, 40 Safety input device, 41 input section, 42 processor, 43 memory, 43A first memory area, 43B second memory area, 44 input calculation section, 45 input diagnosis section, 46 message processing section, 47 execution control section, 48 result verification section , 49 Transmitter, 50 Safety arithmetic device, 60 Safety output device, 61 Output unit, 62 Processor, 6 Memory, 63A First memory area, 63B Second memory area, 64 Power shut-off section, 65 Output diagnosis section, 66 Result collation section, 67 Output calculation section, 68 Message processing section, 69 Execution control section, 70 Receiving section, 80 Gateway , 81 Engineering tools, 83 Switches and sensors, 84 Actuators and contactors, 85 Network connection devices.

In order to solve the above-described problems and achieve the object, the present invention provides a processor that performs program processing of input data, the input data that is input to the processor, and output data that is a result of the program processing. And the memory can hold the input data and the output data in each of a first memory area and a second memory area having an address different from the first memory area. The processor includes a redundancy check of the input data written in the first memory area and the program processing, and a redundancy code for the output data written in the first memory area as a result of the program processing. the first process and the second of said input data written in the memory area redundancy check and the flop including a grant, the An execution control unit that executes a second processing step including: a gram processing; and a redundant code added to the output data written in the second memory area as a result of the program processing; A result collating unit that collates the output data that has been given the redundant code in the process and the output data that has been given the redundant code in the second processing process, and calculates whether the processor and the memory are faulty and calculating diagnostic unit for diagnosing by the redundancy check of the input data in the execution control unit, the comparison of the result verification unit, and when an abnormality is detected in at least one of diagnosis in the operation diagnosis unit, the And an abnormality processing unit for stopping output of the output data.

The execution control unit 13 checks a redundant code accompanying the input data (first input data) written in the first memory area 12A (step S2). The redundant code is, for example, CRC (Cyclic Redundancy Code ).

For example, in the case of an ALU that performs addition , confirmation of each bit (0,0), (0,1), (1,0), (1,1) of two registers to be operated and Carry calculation is performed. Furthermore, in order to confirm that there is no short between adjacent memory bits, test patterns (0x5555 and 0xAAAA) that result in different adjacent bits are selected.

When the input signal is an analog signal, the input diagnosis unit 45 uses a waveform that fluctuates within the range of the analog input range as the test signal. When the input calculation unit 44 confirms the waveform of the test signal, the input diagnosis unit 45 determines that the input unit 41 has no abnormality. The input diagnosis unit 45 may transmit the value within the range of the analog input to the input unit 41 in a plurality of times. When the input calculation unit 44 confirms the value, the input diagnosis unit 45 determines that there is no abnormality in the input unit 41. The input diagnosis unit 45 selects a test signal so that the ON / OFF of each bit after AD conversion can be confirmed.

The message processing unit 46 adds transmission / reception station information and a message number as header information to the communication header of the input data. The message processing unit 46 calculates the CR C for header information and a payload (input data). The message processing unit 46 adds the calculated CRC to the payload.

Safety arithmetic unit 50, by recalculating the CR C, it is possible to detect the bit error of the input message. Further, the safety arithmetic device 50 can determine whether or not the received input message is an input message to be received by checking the header information.

The output message includes a redundant code and accompanying information. The redundant code is, for example, CRC. The incidental information is header information, for example. The message processing unit 68, by recalculating the CR C of the first output message, detects a bit error of the first output message. Further, the message processing unit 68 confirms the transmission / reception station information and the message number, which are header information, to determine whether or not the received first output message is a correct output message from which the safety output device 60 should obtain an output signal. Judging.

Next, the message processing unit 68 inspects the content of the output message (second output message) received by the receiving unit 70, similarly to step S54 (step S57). The message processing unit 68, by recalculating the CR C of the second output message, detects a bit error of the second output message. Further, the message processing unit 68 confirms the transmitting / receiving station information and the message number which are the header information, so that the received second output message is a correct output message from which the safety output device 60 should obtain the output signal. Judging.

The result matching unit 66 reads the first output data from the first memory area 63A. The result matching unit 66 reads the second output data from the second memory area 63B. The result collation unit 66 compares and collates the read first output data and second output data (step S60).

Claims (11)

A processor for performing program processing of input data;
A memory for holding the input data to be input to the processor and output data as a result of the program processing;
The memory can hold the input data and the output data in each of a first memory area and a second memory area having an address different from the first memory area,
The processor is
A first processing step including the program processing of the input data written to the first memory area and the provision of a redundant code to the output data written to the first memory area as a result of the program processing; And a program processing of the input data written to the second memory area, and a redundant code to the output data written to the second memory area as a result of the program processing. An execution control unit for executing the processing steps;
A result matching unit that collates the output data that has been given the redundant code in the first processing step and the output data that has been given the redundant code in the second processing step;
An operation diagnosis unit for diagnosing the presence of a failure in the processor and the memory by operation;
An abnormality processing unit for stopping the output of the output data when an abnormality is detected in at least one of the redundancy check of the input data and the output data, the verification in the result verification unit, and the diagnosis in the arithmetic diagnosis unit; A safety arithmetic device comprising: The execution control unit writes the output data bit-inverted in the second memory area in the second processing step,
The result collating unit collates the output data read from the first memory area and the output data read from the second memory area by mutual exclusive OR. The safety arithmetic device described. The execution control unit writes the output data that has been converted into a complement into the second memory area in the second processing step,
The result collating unit collates the output data read from the first memory area and the output data read from the second memory area with each other's sum. Safety computing device. The execution control unit reverses the endian for one of the output data to be written to the first memory area and the output data to be written to the second memory area,
The result collating unit performs collation by reversing an endian of one of the output data read from the first memory area and the output data read from the second memory area. The safety arithmetic device according to 1.   The execution control unit uses a program generated as a 16-bit compiler in the program processing of the input data read from the first memory area, and the input data read from the second memory area 2. The safety arithmetic apparatus according to claim 1, wherein a program generated as a 32-bit compiler is used in the program processing. A processor for performing program processing of input data;
A memory for holding the input data to be input to the processor and output data as a result of the program processing;
The memory can hold the input data and the output data in each of a first memory area and a second memory area having an address different from the first memory area,
The processor is
A message processing unit for performing an input message process for decoding and checking a redundant code given to an input message including the input data, and an output message process for giving a redundant code to the output data and setting it as an output message;
A first processing step including a control operation for the input message written to the first memory area, and a writing of the output message obtained by the output message process to the first memory area; An execution control unit that executes a control process for the input message written to the memory area and a second processing step including writing the output message to the second memory area after the output message process;
A result collating unit that collates the output message written in the first memory area with the output message written in the second memory area;
An operation diagnosis unit for diagnosing the presence of a failure in the processor and the memory by operation;
An abnormality processing unit for stopping output of the output message when an abnormality is detected in at least one of the redundancy check of the input data and the output data, the verification in the result verification unit, and the diagnosis in the arithmetic diagnosis unit; A safety arithmetic device comprising: An input unit that digitizes the input signal and uses it as input data;
A processor for performing program processing of the input data;
A memory for holding the input data input to the processor;
The memory can hold the input data in each of a first memory area and a second memory area having an address different from the first memory area,
The processor is
An input diagnostic unit for diagnosing the presence or absence of an abnormality in the input unit by transmitting a test signal to the input unit;
A message processing unit for performing an input message process that assigns a redundant code to the input data and sets it as an input message;
A first processing step including arithmetic processing for the input data; writing of the input message to the first memory area; arithmetic processing for the input data; and writing of the input message to the second memory area. A second processing step including: an execution control unit that executes:
A result collating unit that collates the input message written to the first memory area with the input message written to the second memory area;
A transmission unit that transmits the input message to a safety arithmetic device that performs arithmetic processing for safety control, and
The said transmission part stops transmission of the said input message, when abnormality is detected in at least any one of the diagnosis in the said input diagnostic part, and the collation in the said result collation part, The safety input device characterized by the above-mentioned. A processor that performs program processing of the output message;
A memory for holding output data included in the output message;
An output unit that outputs an output signal according to the output data,
The memory can hold the output data in each of a first memory area and a second memory area having an address different from the first memory area,
The processor is
A receiver that receives the output message from the safety arithmetic device that performs arithmetic processing for safety control;
A message processing unit for performing output message processing for checking the content of the output message based on a redundant code included in the output message;
A first processing step including checking the contents of the output message and writing the output data to the first memory area; checking the contents of the output message; and outputting the output data to the second memory area. An execution control unit that executes a second processing step including writing;
A result collating unit that collates the output data written in the first memory area with the output data written in the second memory area;
An output diagnostic unit that diagnoses the presence or absence of an abnormality of the output unit by transmitting a test signal to the output unit;
The output unit stops output of the output signal when an abnormality is detected in at least one of diagnosis in the output diagnosis unit and verification in the result verification unit. A safety input device that accepts input of input signals to the safety controller;
A safety computation device for performing computation processing for safety control;
A safety output device that outputs an output signal from the safety controller,
The safety arithmetic unit is
A processor for performing program processing of input data from the safety input device;
A memory for holding the input data to be input to the processor and output data as a result of the program processing;
The memory can hold the input data and the output data in each of a first memory area and a second memory area having an address different from the first memory area,
The processor is
A first processing step including the program processing of the input data written to the first memory area and the provision of a redundant code to the output data written to the first memory area as a result of the program processing; And a program processing of the input data written to the second memory area, and a redundant code to the output data written to the second memory area as a result of the program processing. An execution control unit for executing the processing steps;
A result matching unit that collates the output data that has been given the redundant code in the first processing step and the output data that has been given the redundant code in the second processing step;
An operation diagnosis unit for diagnosing the presence of a failure in the processor and the memory by operation;
An abnormality processing unit for stopping the output of the output data when an abnormality is detected in at least one of the redundancy check of the input data and the output data, the verification in the result verification unit, and the diagnosis in the arithmetic diagnosis unit; And a safety controller. A safety input device that accepts input of input signals to the safety controller;
A safety computation device for performing computation processing for safety control;
A safety output device that outputs an output signal from the safety controller,
The safety input device is:
An input unit that digitizes the input signal and uses it as input data;
A processor for performing program processing of the input data;
A memory for holding the input data input to the processor;
The memory can hold the input data in each of a first memory area and a second memory area having an address different from the first memory area,
The processor is
An input diagnostic unit for diagnosing the presence or absence of an abnormality in the input unit by transmitting a test signal to the input unit;
A message processing unit for performing an input message process that assigns a redundant code to the input data and sets it as an input message;
A first processing step including arithmetic processing for the input data; writing of the input message to the first memory area; arithmetic processing for the input data; and writing of the input message to the second memory area. A second processing step including: an execution control unit that executes:
A result collating unit that collates the input message written to the first memory area with the input message written to the second memory area;
A transmission unit for transmitting the input message to the safety arithmetic unit,
The said transmission part stops transmission of the said input message, when abnormality is detected in at least any one of the diagnosis in the said input diagnostic part, and the collation in the said result collation part. A safety input device that accepts input of input signals to the safety controller;
A safety computation device for performing computation processing for safety control;
A safety output device that outputs an output signal from the safety controller,
The safety output device is:
A processor for executing program processing of an output message from the safety arithmetic unit;
A memory for holding output data included in the output message;
An output unit that outputs an output signal according to the output data,
The memory can hold the output data in each of a first memory area and a second memory area having an address different from the first memory area,
The processor is
A receiving unit for receiving the output message from the safety arithmetic unit;
A message processing unit for performing output message processing for checking the content of the output message based on a redundant code included in the output message;
A first processing step including checking the contents of the output message and writing the output data to the first memory area; checking the contents of the output message; and outputting the output data to the second memory area. An execution control unit that executes a second processing step including writing;
A result collating unit that collates the output data written in the first memory area with the output data written in the second memory area;
An output diagnostic unit that diagnoses the presence or absence of an abnormality of the output unit by transmitting a test signal to the output unit;
The said output part stops the output of the said output signal, when abnormality is detected in at least any one of the diagnosis in the said output diagnostic part, and the collation in the said result collation part, The safety controller characterized by the above-mentioned.

Images